topic Re: Using 2 lookup tables in one search? in Splunk Search

Using 2 lookup tables in one search?

bcusick — Mon, 04 Aug 2014 15:02:33 GMT

Hi, trying to use two lookup tables in one search. Is this possible?

Basically I have a list of email domains in one lookup table, and a list of users in another. I want to produce a report (with my email data that has both user/email domain fields) for these certain users sending mail to these certain domains. Is there any specific syntax I need to use? Won't see to work.

source=emailRecords, lookup tables are emailDomains.csv and leavers.csv

One thing to note is that I'm using wildcards in my emailDomains.csv....so the field "ToAddress" can look like

*gmail.com,
*yahoo.com, etc.

Re: Using 2 lookup tables in one search?

somesoni2 — Mon, 04 Aug 2014 15:41:58 GMT

I believe something like this should work. For wildcard to work on the lookup table, you need to create lookup definitions and set it to work with wildcard (see this)

source=emailRecords | lookup ludef_emailDomains emailDomain as ToAddress | lookup ludef leavers.csv userName as <<userName field in your logs>>

Updated field names as per your data.

Re: Using 2 lookup tables in one search?

bcusick — Mon, 04 Aug 2014 16:10:53 GMT

This is close...but I'm looking to show only these fields. If I use inputlookup, this works. But I need (if toAddress, bccAddress, or ccAddress) is in the lookup table, return the results. I can do this for one field (inputlookup Emaildomains | fields + toAddress)...but I want it to be any of the three fields

Re: Using 2 lookup tables in one search?

somesoni2 — Mon, 04 Aug 2014 16:24:21 GMT

You might want to add some sample log entries,format of your lookup files etc. Adding more details will help you get more accurate suggestions.